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PRACTICALITY  OF  DIVERSION  PATH  ANALYSIS* 


William  M.  Murphey  and  John  C.  Schleter 
Technical  Analysis  Divisipn 
National  Bureau  of  Standards 


ABSTRACT 

One  can  define  the  safeguards  system  for  nuclear  material  as  the 
set  of  all  protective  actions  taken  to  prevent  or  to  deter  attempts  to  divert 
nuclear  material  to  unauthorized  use„    Maintenance  of  effective  safeguards 
requires  a  program  for  routine  assessment  of  plant  safeguards  systems  in 
terms  of  their  capabilities  to  satisfy  safeguards  aims.     Plant  internal  con- 
trol systems  provide  capabilities  for  detection  of  unprevented  diversion  and 
can  provide  assurance  that  diversion  has  not  occurred.     A  procedure  called 
Diversion  Path  Analysis  (DPA)  enables  routine  assessment  of  the  capabilities 
of  internal  control  systems  in  this  regard  and  identification  of  safeguards 
problem  areas  in  a  plant.    A  framework  for  safeguards  system  design  is  also 
provided  which  will  allow  flexibility  to  accommodate  individual  plant  cir- 
cumstances while  maintaining  acceptable  diversion  detection  capability.  The 
steps  of  the  procedure  are  described  and  the  practicality  of  the  analytical 
method  is  shown  by  referring  to  a  demonstration  test  for  a  high  throughput 
process  where  plant  personnel  were  major  participants.    The  boundary  con- 
ditions for  the  demonstration  case  are  given,  along  with  some  conclusions 
about  the  general  procedure. 

1.  PERSPECTIVE 

For  safeguards,  protective  actions  taken  to  prevent  or  to  deter 
attempts  to  divert  nuclear  material  to  unauthorized  use  may  be  classed  as 
subsystems  by  means  of  which  one  or  more  adversary  actions  may  be  countered. 
Thus,  the  subsystem  for  prevention  of  unauthorized  access  to  a  facility 
addresses  open  attack,  surreptitious  entry,  misrepresentation  without  con- 
cealment of  the  attempt,  etc.,  on  the  part  of  the  adversary.     The  detection 
of  unprevented  theft  represents  yet  another  subsystem. 

Plant  internal  control  systems  have  inherent  capabilities  for 
detecting  unprevented  diversion,  for  providing  recovery  information,  and  can 
also  assist  in  providing  assurance  that  diversion  has  not  occurred.  However, 
a  procedure  is  needed  for  routine  assessment  of  the  capabilities  of  internal 
control  systems  for  indicating  unprevented  diversion;  for  identifying  safe- 
guards problem  areas  within  a  plant;  and  for  substantiating  assurance  state- 
ments.    The  procedure  should  also  provide  a  framework  for  subsystem  design 
which  will  allow  flexibility  in  accommodating  individual  plant  circumstances 
while  maintaining  acceptable  overall  diversion  indication  sensitivity.  Such 
a  procedure,  named  Diversion  Path  Analysis**  (or  DPA)  has  been  developed  and 
is  nearing  completion  as  an  operational  tool. 


*    Work  supported  by  the  U.  S.  Atomic  Energy  Commission,  Division  of  Safe- 
guards and  Security 

**  Specialized  terms  associated  with  DPA  are  listed  in  a  glowwary  at  the  end 
of  the  paper. 
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2.     APPLICATION  OF  DPA 


2.1  Diversion  Path  Analysis 

Although  originally  designed  for  the  assessment  of  internal  control 
procedures,  the  concepts  underlying  DPA  are  also  applicable  to  other 
safeguards  subsystems.     The  following  sequence  focuses  on  the  steps  employed 
in  the  analysis: 

9  identification  of  significant  parameters  for  description  of 
diversion  possibilities; 

•  determining  the  possible  ranges  of  values  of  the  parameters;. 

•  ordering  the  possibilities  by  means  of  the  chosen  trade-off; 
«  assessment  of  a  system  or  a  system  design  in  terms  of 

-  uncovered  "holes"  (or  weak  points)  revealed  through 
the  standard  list  of  possibilities,  and 

-  extent  of  coverage  within  prescribed  tolerance. 

The  procedure  may  be  broadly  applied  to  the  facility  perimeter 
system  for  control  of  facility  access,  to  the  material  perimeter  system  for 
control  of  access  to  material,  and  the  facility  perimeter  system  for  control 
of  removal  of  material  from  the  facility.    However,  in  the  present  context 
DPA  is  discussed  as  a  means  for  assessing  internal  control  systems  to  detect 
covert  diversions  through  systematic  examination  of  paths,  proceeding  in 
order  of  relative  path  complexity  and  material  attractiveness  and  in  light 
of  all  pertinent  knowledge  about  protecting,  handling,  and  storing  Special 
Nuclear  Material  (SNM)  in  the  area  being  assessed.     The  coverage  of  a  par- 
ticular diversion  path  is  evaluated  by  assessing  the  mass,  time,  and  space 
sensitivities  of  indication  of  diversion. 

2.2  Purpose 

DPA  is  intended  to  provide  information  for  management  decision;  to 
locate  "holes"  in  systems  for  detecting  unprevented  theft;  to  balance 
resource  allocation  on  a  subsystem  scale;  and  to  provide  assurance  that 
absence  of  signal  implies  that  no  diversion  has  occurred  within  the 
boundary  conditions  of  the  analysis. 

Information  generated  by  the  DPA  allows  management  to  decide 
whether  the  internal  control  system  needs  to  be  modified  and  how  this  should 
be  done,  as  well  as  whether  there  is  cause  for  alarm.     The  internal  control 
system  may  be  changed  relative  to  the  raw  data  inputs,  data  analyses,  or 
internal  control  procedures.     On  a  continuing  basis,  management  can  review 
experience  with  abnormal  situations;  if  their  frequency  is  high,  perhaps 
internal  controls  should  be  altered  to  reduce  signals  arising  from  innocent 
causes.     However,  any  decision  to  modify  or  upgrade  procedures  should  be 
supported  by  a  specific  statement  (which  results  from  DPA)  of  the  diversion 
possibilities  to  be  covered  by  the  additional  abnormal  situation  test. 
Should  DPA  indicate  that  all  diversion  path  possibilities  are  covered  within 
prescribed  boundary  conditions,  coverage  should  be  explicitly 
recognized  and  "no  action"  is  justified. 
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When  an  abnormal  situation  is  observed,  DPA  generated  information 
specifies  those  diversion  possibilities  which  could  precipitate  the  abnormal 
situation  and  indicates  material  availability,  opportune  times  for  removal 
and  persons  having  authorized  access  during  the  period  in  question.  The 
DPA  also  supplies  a  relatively  objective  list  of  possible  innocent  causes 
of  any  abnormal  situation  under  investigation.     This  permits  careful  review 
and  examination  of  other  possible  causes,  generated  after  the  fact  under 
pressure  for  resolution,  to  assess  their  validity. 

A  key  aim  of  DPA  is  the  location  of  "holes"  in  the  current  system; 
diversion  paths  which  are  not  adequately  countered  within  time  and  mass 
sensitivity  boundary  conditions.     Through  analysis,  such  paths  are  highlighted 
and,  oftentimes,  easily  implemented  countermeasures  come  readily  to  mind. 

The  unprevented  theft  detection  subsystem  may  be  balanced,  for 
resource  allocation  purposes,  relative  to  the  different  possibilities  for 
removing  material.     Such  balance  is  achieved  through  an  ordering  procedure 
for  generalized  diversion  paths  which  is  inherent  with  DPA. 

Assurance  statements  apply  to  the  design,  implementation  or 
operation  of  the  system  during  the  preceding  time  period.     DPA  supports 
assurance  statements  related  to  design  of  systems  for  detection  of  unprevented 
theft,  providing  a  specific  list  of  diversion  possibilities  covered  by  the 
system. 

2.3  Choices 

The  DPA  procedure  requires  making  a  set  of  choices  which  influence 
the  resultant  characterization  of  the  system  with  respect  to  safeguards 
goals.     Some  choices  pertain  to  the  degree  of  risk  to  be  tolerated,  while 
others  relate  to  uniformity  and  consistency  if  DPA  is  to  be  applied  to  a 
number  of  areas  within  a  plant  or  to  a  number  of  plants.     Selection  of 
options  entails  establishment  of  rationales  and,  perhaps,  alternative 
characterizations.     This  was  highlighted  during  a  DPA  test,  particularly 
when  ordering  the  diversion  possibilities  to  be  considered  and  the 
decisions  of  "how  far  to  go"  with  regard  to  degree  of  path  complexity  for 
various  materials  present  in  the  process  area.     Three  fundamental  choices 
apply  to  the  analysis  of  any  area,  namely:    mass  sensitivity,  time  sensitivity 
and  the  relative  weights  assigned  for  material  attractiveness. 

2.3.1    Mass  Sensitivity  Boundary  Value 

Mass  sensitivity  refers  to  the  ability  to  detect  a  single  diversion 
of  X  grams  or  a  series  of  diversions  totaling  at  least  X  grams.  The 
limiting  value  established  for  X  dictates  whether  available  indicators 
provide  adequate  coverage  for  a  given  diversion  path  even  though  other 
procedures  having  better  mass  sensitivity  may  be  available.     If  the 
selected  level  is  seen  to  be  attainable  by  means  of  some  procedure,  no 
further  analysis  need  be  applied  to  that  diversion  path. 

For  purposes  of  analysis,  the  mass  sensitivity  value  has  been 
selected  as  l/10th  of  the  approximate  amount  of  material  which  might  suffice 
for  a  crude  explosive.     Thus,  plutonium  and  U-233  might  be  assigned  a  mass 
sensitivity  of  500  grams  of  contained  fissile  (Pu-239  +  Pu-241) .     A  mass 
sensitivity  of  2.5  kg  contained  fissile  might  be  chosen  for  U-235  and  U-238 
which  leads  to  the  mass  sensitivity/enrichment  relationship  shown  in 
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Figure  2.1    Mass  Sensitivity  as  a  Function  of  Enrichment 
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figure  2.1.     For  the  DP A  test,  the  establishment  of  500  grams  Pu  as  the  mass 
sensitivity  was  further  rationalized  on  the  basis  of  economics  of  information 
precision  and  observed  process  fluctuation  and  control. 

2.3.2  Time  Sensitivity  Boundary  Value 

The  choice  of  time  sensitivity  was  rationalized  through  the 
economics  of  detection,  the  response  time  needed  for  preventing  the 
event,  or  end-use  of  the  material,  and  for  recovery.     In  establishing 
time  sensitivity,  attractiveness  of  material  must  also  be  considered  in 
light  of  possible  events  which  might  be  perpetrated  using  the  particular 
material  type  and  description. 

For  the  practicality  test,  indication  of  diversion  within  24 
hours  for  a  single  removal  or  within  24  hours  of  the  last  removal  of  a 
series  was  chosen  as  the  time  sensitivity  boundary  value  for  very  attractive 
materials.  If  some  indicator  would  meet  this  time  sensitivity,  a  particular 
path  coverage  was  considered  adequate. 

2.3.3  Relative  Weight  Factors  for  Material  Attractiveness 

When  materials  of  several  types  or  descriptions  are  subject  to 
illicit  removal  from  an  area,  they  may  vary  in  desirability  by  virtue  of 
their  relative  adaptability  to  the  diverter's  intended  end-use.  Material 
attractiveness  must  therefore  be  viewed  in  terms  of  resources,  effort 
and  personal  risk  to  the  diverter  which  will  be  involved  in  transforming 
the  diverted  material  into  a  detonatable  form. 

2.4    Conduct  of  DPA 

During  DPA  development,  it  was  estimated  that  a  team  of  three 
members  of  the  plant  staff  could  perform  the  analysis  of  an  area;  the  area 
would  encompass  a  Material  Balance  Area  (MBA)  or  about  10  unit  processes, 
whichever  is  less.     The  team  would  be  composed  of  the  area  process  engineer* 
and  process  foreman  and  a  representative  of  the  plant  safeguards  authority. 
The  process  personnel  bring  to  the  team  first-hand  knowledge  and  can 
quickly  provide  complete  and  detailed  descriptions  and  information  about 
the  process  and  its  operation.     The  plant  safeguards  authority  representative 
brings  knowledge  of  the  DPA  procedure  and  is  responsible  for  performing 
the  analysis.     The  practicality  test  verified  that  this  composition  is 
adequate  for  a  DPA  team. 

Three  basic  steps  are  followed,  each  entailing  a  number  of 
activities;  these  are  schematically  illustrated  in  figure  2.2.  Data 
gathering  refers  to  establishing  the  bounds  of  the  analysis  and  those 
activities  related  to  gaining  thorough  understanding  of  the  conduct  of 
the  process,  its  operation  and  its  performance.   Information  and  data 
gained  in  this  step  allows  a  realistic  analysis  of  the  internal  control 
system  and  provides  knowledge  of  processing  situations  which  would  be 
considered  unusual  by  the  operators,  process  foreman  or  process  engineer. 

Analysis  of  diversion  paths  is  the  systematic  consideration  of 
possible  means  of  removing  nuclear  material  from  the  process  area  and, 

*  The  process  engineer  is  the  professional  (or  professionals)  directly 
responsible  for  improvements  to  the  process  and  for  the  specification 
of  the  internal  and  process  controls  to  be  used  in  the  process  area. 
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Figure  2.2    Basic  Steps  of  Diversion  Path  Analysis 


if  successful,  how  the  removal  would  be  discovered  or  indicated.  Routine 
documentation  of  the  DPA  is  accomplished  through  the  workpapers  and  the 
summary  report.     The  workpaper  document  provides  a  complete  permanent  record 
which  accurately  reflects  the  analysis  performed  and  serves  as  the  basis  for 
follow-up  in  the  event  of  safeguards  problems  and  for  verification  of 
statements  made  in  the  summary  report.     Completeness  of  the  workpapers  is 
essential  to  providing  assurance  about  the  correctness  and  adequacy  of 
the  design  of  the  internal  control  system. 

The  summary  document  for  each  DPA  pinpoints  possible  problem 
areas  in  the  plant  safeguards  system,,     Since  they  are  routinely  reviewed 
by  management,  the  content  should  stand  alone  providing  concise  information 
needed  for  overall  evaluation  and  management  decisions  <>     It  is  essential 
that  results  and  conclusions  of  the  summary  report  be  supported  by  and 
be  traceable  to  the  workpapers. 

2.4.1    Data  Gathering 

There  are  four  facets  associated  with  data  gathering  each  composed 
of  a  number  of  activities  as  illustrated  in  figure  2.3 

2.4.1.1  Establish  the  Bounds  of  the  DPA 

Explicit  agreement  must  be  reached  among  the  team  members  as  to 
what  portion  of  the  facility  is  to  be  analyzed.     Later,  a  review  is  made 
to  ensure  that  no  portion  of  plant  activities  has  been  neglected.  There 
are  three  types  of  bounds  to  the  analysis,  the  first  of  which  is  the 
process  bound,  an  explicit  statement  of  the  process  activities  encompassed 
by  the  analysis.     Second  is  the  materials  accountability  bound.  Because 
of  the  independence  of  measurements,  personnel  and  geographic  localization 
of  currently  defined  MBA's,  an  analysis  will  rarely  cross  an  MBA  boundary. 
However,  large  or  very  complex  material  balance  areas  may  be  subdivided 
for  purposes  of  analysis  into  groups  of  about  ten  unit  processes.  Third 
is  the  personnel  bound,  that  is,  which  personnel  are  explicitly  to  be 
considered  as  potential  diverters  for  the  area  under  scrutiny.     Those  to 
be  included  in  the  class  of  potential  diverters  cannot  conduct  the 
analysis . 

In  the  practicality  test,  the  process  bounds  began  with  acceptance 
of  material  coming  into  an  MBA  and  ended  with  shipment  verifications  as 
the  material  was  transferred  to  the  following  MBA.     The  accountability 
bounds  were  the  material  balance  area,  and  the  personnel  bounds  were  all 
process  operators  assigned  to  the  area,  outside  visitors  who  might  be  in 
the  area,  plant  employees  assigned  to  other  material  balance  areas, 
construction  personnel  who  would  not  be  plant  personnel  but  who  have 
access  to  the  interior  of  the  plant,  and  persons  not  authorized  to  be  in 
the  area. 

2.4.1.2  Identify  the  Unit  Processes 

For  purposes  of  analysis,  the  overall  process  stream  of  a  plant 
is  subdivided  into  many  smaller  operations,  called  unit  processes,  each 
of  which  is  characterized  by  a  "branch  point"  in  the  process  stream, 
that  is,  where  material  changes  its  physical  or  chemical  form  or  composition, 
or  where  by-product,  such  as  recycle  or  scrap,  is  generated.  Further 
details  of  the  concept  and  identification  of  unit  processes  have  previously 
been  described  [1], 
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Figure  2.3      Activities  Associated  with  the  DPA  Data  Gathering  Step 


8 


Each  unit  process,  identified  in  the  previous  step,  is  now 
examined  in  depth  in  order  to  assure  that  the  points  indicated  in  figure 
2.3  under  this  heading  are  fully  understood  by  each  member  of  the  DPA 
team.     Topics  discussed  while  carrying  out  this  step  in  the  course  of 
the  practicality  test  are  listed  in  table  2.1. 

The  detailed  examination  results  in  an  annotated  material  and 
information  flow  diagram  for  each  unit  process.     Preparation  of  these 
diagrams  is,  however,  reserved  until  the  analysis  step  described  below. 

2.4.1.4    Diversion  Inquiry  Session 

The  diversion  inquiry  session  provides  a  forum  for  quickly 
interchanging  raw  information  among  members  of  the  DPA  team  in  order  to 
expose  diversion  possibilities  and  their  covers.     Our  experience  has 
been  that  plant  personnel  of  the  caliber  composing  the  team  have  already 
given  thought  to  means  of  removal  and  can  readily  make  suggestions  as  to 
which  paths  are  possible  and  the  status  of  current  cover.    Major  points 
to  be  discussed  in  the  session  are  set  forth  in  figure  2.3. 

•  Choice  of  Diversion  Indication  Sensitivity  Objectives 

Sensitivity  objectives,  possibly  in  the  form  of  guidelines 
may  be  established  in  the  future  for  purposes  of  consistency  and 
comparability  between  DPA's.     In  the  interim,  corporate  establishment  of 
objectives  can  contribute  toward  this  goal.     Otherwise,  the  choice  of 
sensitivity  Objectives  falls  to  the  DPA  team.     The  choices  of  mass  and 
time  sensitivities  for  the  practicality  test  have  already  been  discussed, 
space  sensitivity  was  automatically  restricted  to  the  MBA  under  scrutiny. 

«  Materials  List;  Material  Attractiveness 

i 

The  list  of  materials,  different  material  types  (if  more  than 
one  is  present  in  the  process  area)  and  different  material  descriptions 
(chemical  and  physical  forms)  will  be  a  direct  output  of  the  detailed 
examination  of  the  unit  processes.    Relative  material  attractiveness 
(pending  a  uniform  choice  or  more  specific  guidelines)  must  then  be  opted. 

•  Divers  ion  Path  Discussion 

The  heart  of  the  diversion  inquiry  session  is  consideration 
of  all  conceivable  diversion  possibilities.     Adequately  covered  paths  can 
usually  be  dismissed  quickly  at  this  point,  leaving  the  remaining  time  for 
discussion  of  paths  not  currently  covered.     In  the  practicality  test,  the 
foreman  and  process  engineer  possessed  knowledge  which  allowed  rapid 
dismissal  of  many  diversion  paths  as  meaningless,  permitting  focus  on  more 
meaningful  potential  paths. 
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A.  CHEMISTRY 

1.  CHEMICAL  EQUATIONS 

a.  REACTIONS 

b.  ENERGY  RELATIONS 

c.  REACTION  RATES 

2.  RESULTS 

a.  EXPECTED  (THEORETICAL) 

b.  EXPERIMENTAL  (CHEM  R&D) 

B.  CHEMICAL  ENGINEERING 

1.  CHEMICAL  ENGINEERING  CONSIDERATIONS 

2.  PROCESSING  PROBLEMS 

a.  POSSIBLE  CAUSES  OF  LOW  Pu  IN  SCRAP 

b.  POSSIBLE  CAUSES  OF  HIGH  Pu  IN  SCRAP 

c.  OTHER  PROBLEMS 

FAMILIARIZATION  WITH  PROCESS  AREA 


C. 
D. 


PROCESS  PROCEDURES 

1. 

OPERATION 

2, 

OPERATION 

n 

3. 

OPERATION 

4. 

OPERATION 

4 

OPERATION 

5  J 

OPERATOR  ACTIVITIES 
FORMS  COMPLETED 
ROUTING  OF  FORMS 
EACH  TO  J   RECORD  MAINTENANCE 

INCLUDE  ]  RECORD  ACCESSIBILITY 

ENGINEERING  CALCULATIONS 
ENGINEERING  JUDGMENTS 
EXPERIENCE  ^ENGINEERING  DECISIONS 

1.  YIELDS 

2.  FREQUENCY  AND  CAUSES  OF  BAD  YIELDS 

3.  OTHER  PROCESS  PROBLEMS 

4.  MISPLACED  MATERIAL  (RESOLUTION  TIME  AND  EXPLANATIONS) 

5.  RESIDENCE  TIMES  FOR  MATERIAL  IN  VARIOUS  PROCESS  STEPS 

6.  RESIDENCE  TIME  OF  SCRAP  IN  STORAGE 

7.  COMPARISON  OF  BY-DIFFERENCE  SCRAP  TAG  VALUES  AND  RECOVERY  VALUES 

8.  NDA  EXPERIENCE  WITH  SCRAP 

9.  PRIOR  PERIOD  ACCOUNTING  ADJUSTMENTS 
10.     ACCOUNT  MUF  VALUES 


Table  2.1      Topics  Discussed  For  Detailed  Examination  of  Unit 
Processes  During  Practicality  Test 
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Typical  questions  were:     "If  you  were  after  such-and-such 
material,  what  specifically  would  you  take  and  how  would  you  do  it?" 
The  ensuing  discussion  led  to  "How  would  you  know  the  removal  had  occurred?" 
and  "How  could  you  determine  this  type  of  falsification,  substitution  or 
whatever  more  quickly?" .     Although  the  discussion  concentrated  on  more 
complicated  paths,  information  was  also  provided  about  the  coverage  of  less 
complicated  paths,  usually  expressed  as  "you  wouldn't  do  that  because...". 

The  sequence  of  analyzed  paths  is  soon  terminated    at  a 
point  where  remaining  paths  have  relative  weight  values  less  than  the 
pre-selected  boundary  conditions  (related  to  credibility  as  a  function  of 
path  complexity) ;  another  material  is  then  selected  for  consideration. 
The  procedure  ends  when  each  material  in  the  precess  area  has  been  considered 
at  all  locations  where  that  material  may  be  found. 

2.4.2  Analysis 

Data  gathering  and  the  inquiry  session  illuminate  the  safeguards 
status  of  the  area  under  scrutiny,  and  analysis  provides  assurance  of 
completeness.     One  is  thereby  assured  that  there  are  no  paths  which  are 
either  uncovered  or  only  marginally  covered  (that  is  there  are  no  "holes" 
in  the  internal  control  procedures)  within  the  boundary  conditions.  The 
analysis  portion  of  the  DPA  is  illustrated  in  figure  2.4.     Each  step  is 
amplified  below. 

2.4.2.1    Process  and  Internal  Control  Understanding 

•  Generate  the  Information  and  Material  Flow  Diagrams 


The  data  are  analyzed  to  isolate  the  following  information  and 
material  flows  for  each  unit  process: 

-  incoming  material  and  information  flows; 

-  information  and  data  generated  at  this  node; 

-  records  maintained  at  this  node; 

-  records  and  reports  prepared  at  this  node; 

-  outgoing  material  and  information  flows;  and 

-  other  characterizations  of  the  node  such  as 
material  handling  activities. 

The  resulting  information  is  summarized  in  an  annotated  diagram, 
shown  for  the  general  case  in  figure  2.5  and  for  a  particular  unit  process 
examined  in  the  course  of  the  practicality  test  in  figure  2.6.  Accompanying 
these  diagrams  are  notes  in  which  the  material  and  information  flows  are 
detailed.  The  notes  shown  in  outline  form  in  tables  2.2  and  2.3  correspond 
to  the  diagrams  in  figures  2.5  and  2.6,  respectively.     It  may  be  observed 
that  the  diagrams  and  notes  are  less  complex  for  the  actual  unit  process 
than  for  the  generalized  case  since  the  latter  must  include  all  possible 
flows,  many  of  which  may  not  apply  in  a  particular  situation. 

•  Numerical  Analysis  of  Process  Data 

The  end  result  of  numerical  analysis  of  process  data  is  a 
characterization  of  all  variables  which  might  reasonably  be  expected  to 
have  safeguards  significance  by  manifesting  abnormal  fluctuation  should 
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ABNORMAL  SITUATION  OBSERVED 

OBSERVER  IDENTIFICATION 
MASS  SENSITIVITY 
TIME  SENSITIVITY 
INNOCENT  CAUSES 


INDICATION  SENSITIVITY  OBJECTIVE  GUIDELINES 


MASS 
TIME 
SPACE 


} 


AS  A  FUNCTION  OF  MATERIAL 
ATTRACTIVENESS 


ANALYSIS 


PROCESS  AND  INTERNAL  CONTROL  UNDERSTANDING 

INFORMATION  AND  MATERIAL  FLOW  DIAGRAMS 
EXPLANATORY  OUTLINE 
NUMERICAL  ANALYSIS  OF  PROCESS  DATA 
TIMING  INFORMATION 


CONSIDERATION  OF  EACH  GENERALIZED  DIVERSION  PATH 

ORDERED  DIVERSION  PATH  CHECK  LIST 
CONSIDERATION  OF  EACH  PATH  IN  ORDER  OF 
EACH  MATERIAL 
NO  COLLUSION 
COLLUSION 
DIVERSION  PATH  NOTES 
DIVERTER 
MATERIAL 

CONCEALMENT  SCHEME 
ABNORMAL  SITUATION 

POSSIBLE  INNOCENT  CAUSES  OF  ABNORMAL  SITUATION 
SENSITIVITY  AS  A  FUNCTION  OF  DISTRIBUTION  OF 
DIVERTED  AMOUNTS 
DIVERSION  PATH  CHECK-OFF  DATA 


SUMMARIZATION  OF  DIVERSION  PATH  DATA 
ABNORMAL  SITUATION  LIST 

LIST  OF  DIVERSION  PATHS  FOR  GIVEN  ABNORMAL  SITUATION 
DIVERSION  PATH- -ABNORMAL  SITUATION  CROSS-REFERENCE  TABLE 
INTERNAL  CONTROL  HISTOGRAM  CHARACTERIZATION 
NO  COLLUSION 

FOR  EACH  MATERIAL 

FOR  ALL  MATERIALS 
COLLUSION 

FOR  EACH  MATERIAL 

FOR  ALL  MATERIALS 
SINGLE  PARAMETER  MEASURE 


Figure  2.4      Activities  Associated  with  the  DPA  Analysis  Step 
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material  be  removed  at  some  point  of  the  process.     Possible  types  of  numerical 
analysis  of  process  data  were  covered  in  detail  in  an  earlier  paper  [1] . 

•  Timing  Information 

Timing  information  may  come  from  interview,  the  opinions  of 
the  foreman,  etc.,  or  from  analysis  of  process  data.     Impressions  may  not  be 
entirely  accurate,  so  timing  information  gained  through  interview  should  be 
verified,  when  possible,  by  process  data.     The  information  required  for 
establishing  time  sensitivity  is: 

-  residence  time  of  all  materials  at  intermediate 
points ; 

-  time  for  completion  of  operations; 

-  time  between  measurement  and  incorporation  of  the 
measurement  into  the  safeguards  system; 

-  time  between  completion  and  analysis  of  information 
on  forms ; 

-  time  between  notice  of  an  abnormal  situation  and 
response;  and 

-  inventory  frequency. 

2.4.2.2    Consideration  of  each  Generalized  Diversion  Path 

Central  to  diversion  path  analysis  is  the  systematic  consideration 
of  paths  or  diversion  possibilities. 

1   •  Ordered  Diversion  Path  Check  List 

A  standard  check  list  of  diversion  path  possibilities  is 
generated  based  oil  diversion  path  parameter  combinations,  an  accepted  set 
of  relative  weight  factors,  and  a  path  ordering  program.     In  generating  the 
list,  one  can  use  the  generic  names  for  material  attractiveness  or  the  material 
descriptions  specific  to  the  process  under  analysis. 

The  relative  weight  factors  associated  with  material  attractiveness 
and  path  complexity,  the  latter  being  the  remaining  parameter  values  taken 
collectively,  combine  to  form  the  relative  path  weight;  they  thus  enter  into 
safeguards  significance  in  two  ways.    First,  they  determine  the  order  in  which 
paths  are  to  be  examined  and  second,  they  determine  which  paths  lie  below  the 
cutoff  and  are  not  to  be  examined  in  depth.     In  selecting  the  cutoff  point,  one 
must  consider  credibility  of  paths  as  a  function  of  complexity  and  of  material 
attractiveness.     Paths  just  below  the  chosen  cutoff  should  be  examined  at  least 
cursorily  to  assure  that  no  credible  paths  have  been  neglected,  otherwise  the 
cutoff  decision  must  be  re-examined. 

The  diversion  path  parameters,  parameter    values,  and  associated 
relative  weight  factors  used  in  the  practicality  test  are  shown  in  generalized 
form  in  table  2.4.    As  discussed  in  an  earlier  paper  [1],  a  product  of 
relative  weight  factors  determines  a  relative  path  weight  and  enters  the 
implicit  trade-off  between  material  attractiveness  and  path  complexity.  The 
first  page  of  a  standard  list  using  generic  material  descriptions  is  shown  in 
table  2.5.    A  forthcoming  paper  [2]  will  provide  a  more  complete  description 
of  the  path  ordering  program  and  procedures. 
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DIVERSION   PATH  PARAMETER'S 


RELATIVE  WEIGHT  FACTOR 


MATE6 

I AL    AT TR AC T I VFNF SS  (Ml 

Ml 

FEED  PRODUCT 

I. 000000 

M2 

R  ECYCLE 

o  500000 

M3 

SCRAP 

o .  ?ooooo 

M4 

LAB  SAMPLES 

0 .  1  DOOQO 

M5 

WASTE 

o « n i oooo 

RECORDS  (F) 

Fl 

NO  FALSIFICATION 

1  .000000 

F2 

FALSIFY  NOM  MEASUREMENT  DATA 

o  q  n  n  o  o  o 

F3 

FALSIFY  GROSS   AND/C  NET  WT 

0.p00000 

F4 

FALSIFY  CONCENTRATION  MEASMT 

o  sonnno 

F5 

FALSIFY  NET/COS  UNCERTAINTY 

n  ?noniio 

F6 

FALSIFY  ISOTOPIC  COMPOSITION 

o  i noono 

F7 

FALSIFY  CONC/ ISOTOPIC  UNCERT 

0  070000 

DISTRIBUTION  OF  DIVERTED  AMOUNTS  \D\ 

Dl 

1 

1 . uoouuo 

02 

2 

0.707  107 

D3 

3 

0  .  5773*10 

D4 

4 

0 . 500000 

W  1    ^  u  U  -J  u  w 

D5 

5 

0.4W214 

D6 

6 

o    40  fl  ?  4  A 

D7 

7 

0. 377964 

D8 

fl 

0.353553 

D9 

0.333333 

DIO 

10 

Q.  316228 

Dll 

15 

0. 25^199 

D12 

20 

0.223607 

D13 

25 

0.200000 

D14 

30 

0.182  574 

D15 

35 

0.169031 

D16 

40 

0.158114 

D17 

45 

0-149071 

DIB 

50 

0.  141421 

REMOVAL  MODE  |R) 

RL 

S I  MP  LE 

1 . 000000 

R2 

SUB-INERT 

0. 700000 

R3 

SUB-ISOTOP IC 

0.1 00000 

NUMBER  OF   INDIVIDUALS  (!) 

U 

1 

1  s  UU J JUU 

12 

2 

13 

3 

U  ♦  1  i  i 

14 

4 

0.037036 

15 

5 

0.01  ?  45 

16 

6 

0.004115 

17 

7 

0.001 372 

18 

8 

0.000457 

19 

9 

0.000 152 

1 10 

10 

0 . 00005 1 

TYPE 

OF    INDIVIDUAL  (P) 

PI 

INSIDER 

1.000000 

P2 

OUTSIDE  EMP 

0.500000 

P3 

OUTSIDE  VSTP 

0.100000 

P4 

UNAUTHORIZED 

0. 100000 

Table  2.4    Diversion  Path  Parameters,  Parameter  Values  and  Associated 
Relative  Weight  Factors 
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It  was  found  useful  to  separate  the  generated  ordered 
paths  into  two  groups,  the  first  of  which  comprised  all  paths  with  relative 
weight  0.1  or  greater.     The  second  group  consisted  of  paths  with  relative 
weights  less  than  0.1  to  bring  the  total  number  of  paths  to  3000.  Remaining 
paths  had  relative  weights  still  smaller  than  those  of  listed  paths.  Within 
the  major  groups,  sub-groups  were  formed,  classifying  in  turn  by  material 
attractiveness  and  the  number  of  individuals  working  in  collusion.  Ordering 
within  sub-groups  by  relative  weight  was  then  carried  out.     In  all,  the  first 
group  had  192  paths  associated  with  feed-product,  99  with  recycle,  14  with 
scrap,  1  with  lab  samples  and  none  with  waste.     The  number  of  paths  for  a 
given  material  attractiveness  category,  however,  depends  on  the  choice  of 
material  attractiveness  relative  weight  factors;  the  sensitivity  in  choosing 
parameter  values  is  currently  being  examined.    The  effect  of  the  weight  factors 
on  system  characterization  and  total  coverage  is  small  because  the  list  is 
used  only  for  ordering  the  sequence  of  path  examination.     In  fact,  if  all 
paths  can  be  covered,  then  the  weight  factors  have  no  effect. 

•  Consideration  of  each  Path  in  Order 

The  path  list  is  then  used  as  a  guide  to  analyze  diversion 
possibilities.    For  a  given  material,  starting  with  persons  acting  alone,  the 
internal  control  system  is  checked  for  possible  diversion  paths  satisfying 
the  generalized  path  parameters.    Any  diversion  possibilities  are  recorded, 
along  with  possible  corresponding  indicators  of  an  abnormal  situation.  Actual 
diversion  paths  may  not  match  generalized  diversion  paths  on  a  one-for-one 
basis.    More  actual  paths  may  derive  from  material  in  the  process  or  the 
make-up  of  potential  diverters  (from  among  the  process  operators,  for  example). 
Conversely,  a  simple  diversion  path  may  correspond  to  several  generalized 
paths,  as  in  the  case  of  different  numbers  of  separate  removals  in  a  series  to 
add  up  to  the  desired  mass  sensitivity.    Physical  constraints  of  a  process  may 
preclude  some  paths.    For  example,  if  all  process  samples  are  about  10  grams, 
500  grams  cannot  be  obtained  with  only  one  removal.     The  basis  for  physical 
exclusion  of  any  paths  should  be  recorded. 

•  Diversion  Path  Notes 

Diversion  path  notes  in  the  workpapers  are  the  documentation  of  the 
considerations  given  each  diversion  path.     They  should  include: 

-  diverter  -  the  person  or  persons  who  are  the  potential 
diverters; 

-  material  -  the  amount,  type,  chemical  form,  physical 
form,  and  authorized  location  of  the  material  to  be 
taken; 

-  concealment  rationale  -  why  the  diverter  chooses  a  given 
type  of  concealment,  including  the  size  of  the  individual 
diversions  in  a  series,  explicitly  what  information  is 
falsified,  how  that  falsification  will  conceal  the 
diversion,  and  the  removal  mode  (see  table  2.4); 

-  abnormal  situation  -  a  description  of  the  first 
observable  indication  of  abnormal  situation  resulting 
from  the  diversion; 
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-  related  innocent  causes  -  unusual  circumstances  which 
would  innocently  cause  the  same  abnormal  situation 
(possible  causes  of  false  alarms) ;  and 

-  sensitivity  as  a  function  of  the  distribution  of 
diverted  amounts,  that  is,  if  the  time  sensitivity  is 
a  function  of  the  number  of  separate  removals  in  a 
series  (see  table  2.4). 

•  Diversion  Path  Checkoff  Data 

The  checkoff  procedure  is  used  to  record  the  worst  time  sensitivity 
for  a  set  of  specific  paths  satisfying  a  generalized  diversion  path  in  the 
check-off  column  (table  2.5).     If  that  worst  time  sensitivity  is  within  the 
boundary  condition,  one  proceeds  to  the  next  generalized  path,  otherwise, 
consideration  is  given  to  other  possible  abnormal  situations  which  are  not 
currently  observed  but  which  might  provide  the  desired  indication. 

For  example,  a  second  copy  might  be  added  to  work  instructions; 
by  denying  the  diver ter  access  to  that  second  copy,  the  foreman's  comparison 
of  the  completed  work  form  with  the  second  copy  would  reveal  falsification 
with  respect  to  material  used  in  the  process,  its  identity,  or  other  data  on 
the  work  forms. 

Similarly,  a  shadow  measurement  of  the  canned  and  tagged  final 
product  or  material  going  into  storage  would  uncover  substitution  of  inert 
material. 

Failure  to  identify  a  way  to  cover  the  diversion  path  within  the 
time  boundary  condition  is  recorded  in  the  third  column  of  the  check-off 
list.     Data  in  the  check-off  columns  form  the  basis  for  generation  of  the 
characterization  histograms. 

2.4.2.3    Summarizing  Diversion  Path  Data 

•  Abnormal  Situation  List 

All  abnormal  situations  which  are  related  to  the  diversion 
possibilities  considered  during  the  analysis  are  listed.     It  is  useful  to 
number  the  abnormal  situations  notes  as  well  as  those  for  diversion  paths 
for  ease  of  reference. 

•  List  of  Diversion  Paths  For  a  Given  Abnormal  Situation 

The  paths  to  be  investigated  following  observation  of  an  abnormal 
situation  are  listed.     A  standard  operational  procedure  is  followed  to 
determine  if  the  observed  situation  is  due  to  an  innocent  cause  and,  if 
not,  then  to  initiate  investigative  action.     For  example,  observation  of  a 
bad  yield  as  the  abnormal  situation  should  lead  to  routine  inquiry  to  verify 
that  the  stated  amount  of  SNM  was  in  the  scrap,  recycle  or  waste  streams 
related  to  that  yield  value.     If  the  abnormal  situation  is  not  innocently 
resolved,  then  it  is  necessary  to  start  an  investigation,  and  knowledge  of 
potential  paths  for  the  given  abnormal  situation  comes  into  play. 

•  Diversion  Path  -  Abnormal  Situation  Cross-Ref erence  Table 

The  diversion  path  -  abnormal  situation  cross-reference  table  is 
a  tabulated  summary  of  information  contained  in  the  list  of  diversion  paths 
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considered  during  the  analysis.     It  displays  the  diversion  paths  which  have 
a  detection  time  sensitivity  problem;  sensitivities  as  a  function  of  number 
of  removals  (where  that  is  applicable) ;  and  the  abnormal  situation  for  each 
diversion  path.     The  first  page,  with  certain  deletions,  of  the  diversion 
path  -  abnormal  situation  cross-reference  table  from  the  practicality  test 
is  shown  in  table  2.6. 

•  Internal  Control  Histogram  Characterization 

The  purpose  of  every  aggregation  of  raw  data  is  to  highlight  seme 
aspect  of  results  of  the  analysis.     For  the  internal  control  histogram,  the 
object  is  to  allow  a  relatively  high  level  manager  to  see  at  a  glance  which 
analysis  areas  have  safeguards  problems  and,  in  the  context  of  the  known 
boundary  conditions,  to  furnish  insight  as  to  what  can  be  achieved  by  including 
additional  abnormal  situation  observations  in  the  internal  control  system. 

Figure  2.7  illustrates  an  internal  control  histogram  generated 
during  the  practicality  test  and  the  change  in  system  coverage  stemming  from 
additional  observations  for  abnormal  situations.     The  bars  represent  the 
fraction  of  the  generalized  diversion  paths  falling  within  each  relative 
path  weight  range,  which  are  detected  as  abnormal  situations  within  the 
indicated  time  sensitivity  ranges.     The  data  for  the  upper  histogram  came 
from  the  diversion  path  list  in  conjunction  with  a  knowledge  of  the 
characteristics  and  time  response  of  the  abnormal  situations.     For  the  lower 
(modified  coverage)  histogram,  a  new  set  of  data  was  generated  by  considering 
the  change  in  each  of  the  time  sensitivities  resulting  from  some  additional 
observations  in  the  internal  control  system. 

•  Single  Parameter  Measure 

A  further  level  of  aggregation  of  DPA  data  has  been  considered. 
The  weights  reflecting  the  relative  usefulness  to  safeguards  recovery  response 
may  be  combined  from  histogram  information  into  a  single,  normalized  number 
through  a  weighted  summing.     This  becomes  an  aggregated  index  of  the  useful- 
ness of  the  particular  internal  control  system  for  safeguards.     As  for  the 
internal  control  histogram,  it  is  essential  that  a  safeguards  problem  be 
reflected  by  such  a  composite  index,  and  that  the  index  not  indicate  a 
safeguards  problem  when,  in  fact,  there  is  none. 

2.4.3  Documentation 

2.4.3.1  Workpapers 

The  workpaper  document  provides  evidence  of  and  basis  for 
conclusions  from  the  analysis,  as  well  as  motivation  for  and  justification 
of  recommended  modifications  to  the  internal  control  system.     It  also 
provides  assurance  to  plant  management  of  the  validity  of  the  safeguards 
properties  of  the  internal  control  system,  a  basis  for  assurance  to  the 
AEC  regarding  internal  control  system  diversion  detection  sensitivity, 
and  a  basis  for  investigating  an  abnormal  situation  which  cannot  be 
immediately  ascribed  to  an  innocent  cause. 

After  the  analysis  step,  all  information  in  hand  must  be  reviewed 
for  consistency,  completeness  and  understandibility .     Figure  2.8  summarizes 
items  which  should  appear  in  the  workpapers,  including  most  information 
and  data  collected  for  the  study. 
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2.4.3.2.     The  Summary  Report 


The  summary  report  presents  highlights  for  management  review 
of  pertinent  facts  and  conclusions  contained  in  the  workpapers.  It 
should  be  sufficiently  detailed  and  complete  to  allow  understanding  by  a 
manager  who  is  only  generally  familiar  with  the  process.     The  contents, 
summarized  in  figure  2.9,  state  briefly  the  bounds  of  the  analysis, 
process  description,  summary  of  the  numerical  analysis,  timing  information, 
number  of  paths  analyzed,  worst  case  information  under  current  and 
future  coverage,  and  characterization  of  the  internal  control  system 
relative  to  safeguards  goals. 

2.4.4         Results  of  the  Test  of  the  DPA  Procedure 

A  DPA  was  conducted  with  plant  personnel  performing  the  major 
role  in  data  gathering  and  provision  of  base  information  on  diversion 
paths  through  the  inquiry  session.     NBS  took  the  basic  data  and  generated 
the  remaining  diversion  path  information,  the  workpapers  and  the  summary 
report.     The  results  are  presented  in  distilled  form  to  protect  company 
proprietary  information.  i 

"Holes"  are  identified  in  the  system  through  the  DPA  procedure 
by  highlighting  specific  actions  which  might  be  taken  by  the  diver ter. 
Often,  not  much  imagination  is  required  to  specify  additional  internal 
control  procedures  to  cover  the  diversion  possibility. 

Conclusions  from  the  test' were: 

•  The  systematic  conduct  of  a  comprehensive  DPA  is  feasible  and 
can  be  performed  without  excessive  expenditure  of  time  and  effort  by  plant 
personnel  "knowledgeable  of  the  process  area  under  consideration; 

•  DPA  can  be  used  to  characterize  in-plant  information, 
procedures,  measurements  and  controls  with  respect  to  safeguards  goals 
using  general,  straightforward  analysis  techniques.     Validity  of  the 
analysis  is  critically  dependent  on  knowledge  of  process  practices  actually 
employed,  in  contrast  to  practice  as  specified  in  manuals.     Further,  DPA 
provides  a  means  of  demonstrating  additional  coverage  of  diversion 
possibilities  which  might  be  gained  through  modification  of  present  plant 
practice;  *  *  *  *       "**  "  v" 

•  A  number  of  parameters  were  identified  which  permitted  a  choice 
for  value.     When  made,  such  choice  could  be  supported  by  a  rationale  which 
was  not  necessarily  amenable  to  determination  by  objective  analysis.  The 
choices  constituted  the  general  boundary  conditions  for  considering  and 
ordering  generalized  diversion  paths  as  a  function  of  path  complexity  and 
material  attractiveness.     For  the  DPA,  it  is  essential  that  the  ordered 
list  of  generalized  diversion  paths  be  complete  and  present  all  diversion 
path  parameter  value  combinations  for  consideration.     Some  will  be  impossible 
because  of  process  constraints  in  the  specific  case;  these  need  be  given  no 
further  consideration. 
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•  The  DPA  of  a  specific  process  area  was  completed  based  on  the 
choice  of  one  set  of  relative  weight  factors.     Additional  information  is 
needed,  however,  of  the  effect  of  alternative  assignments  for  relative 
weight  factors,  and  mass  and  time  sensitivity  limits.     Also  the  analysis 
procedure  used  in  this  initial  DPA  led  to  a  characterization,  by  means  of 
histograms,  of  the  safeguards  effectiveness  of  the  internal  control  system; 
alternative  means  should  be  explored  and  tested. 

3.  SUMMARY 

This  paper  reflects  current  understanding  of  the  context  and 
steps  of  a  routine  diversion  path  analysis  as  applied  by  plant  personnel 
to  internal  control  systems.     The  basic  steps  of  data  gathering,  analysis 
and  documentation  were  discussed.     In  particular,  emphasis  was  placed  on 
the  analyses  steps  for  understanding  process  and  internal  control; 
consideration  of  diversion  paths  ordered  according  to  generalized  diversion 
path  parameter  combinations;  and  generation  of  histograms  characterizing 
the  safeguards  usefulness  of  internal  control  systems  for  safeguards 
goals. 

Conclusions  from  the  most  recent  test  of  DPA  were  presented, 
demonstrating  that  it  is  possible,  practical  and  feasible  (without 
excessive  cost)  for  plant  personnel  to  carry  out  routine  DPA.  The 
foreman  and  process  engineer,  together  with  a  representative  of  the 
plant  safeguards  authority  group,  should  form  the  DPA  team.     The  coverage 
provided  by  the  internal  control  system  and  possible  alternatives  can  be 
analyzed  and  results  presented  to  fairly  represent  safeguards  usefulness 
of  the  system. 
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GLOSSARY 


ABNORMAL  SITUATION 

An  occurrence  inconsistent  with  historical  experience  and/or  normal 
process  operation  which  can  be  related  to  possible  diversion  of  SNM. 

BOUNDARY  CONDITION 

A  specific  value  assigned  to  a  variable  for  the  purpose  of  delimiting 
an  analysis. 

COVERED  PATH  (COVERED) 

A  diversion  path  for  which  indication  of  an  abnormal  situation  would 
result,  within  the  mass  and  time  sensitivity  boundary  conditions,  if 
diversion  were  attempted  by  means  of  that  path. 

DISTRIBUTION  OF  DIVERTED  AMOUNTS 

A  diversion  path  parameter  for  describing  the  mass  of  SNM  in,  and 
number  of,  separate  removals  included  in  a  diversion  path. 

DIVERSION 

The  illicit  removal  of  SNM  from  uses  permitted  by  law  or  treaty 
(theft,  robbery,  or  unauthorized  or  illegal  acts  committed  by 
persons  in  authority) .    The  authorized  transfer  of  SNM  from  one  use 
to  another  in  the  materials  management  sense,  also  called  diversion, 
is  not  considered  a  part  of  these  studies. 

DIVERSION  PATH  (PATH) 

The  complete  and  detailed  description  of  a  modus  operandi  and 
rationale,  devised  as  an  independent  method,  for  illicitly  removing 
and  concealing  the  fact  of  removal  of  SNM. 

DIVERSION  PATH  ANALYSIS 

A  procedure  for  directing  systematic  analysis  of  diversion  paths, 
ordered  according  to  relative  path  complexity  and  material 
attractiveness,  in  light  of  all  pertinent  information  about 
protection,  handling  and  storing  of  SNM  in  the  area  under  scrutiny. 
How  well  a  particular  diversion  path  is  now  or  might  in  future  be 
covered  is  evaluated  by  assessing  the  mass,  time  and  space 
sensitivities  of  indication  of  attempted  diversion. 

DIVERSION  PATH  PARAMETER 

A  variable  associated  with  a  generalized  diversion  path  description, 
such  as:   (1)  material  attractiveness;   (2)  falsification  of  records; 
(3)  distribution  of  diverted  amounts;  (4)  removal  mode;   (5)  number  of 
individuals;  and  (6)  type  of  individual. 

DIVERSION  PATH  PARAMETER  VALUE 

An  attribute  of  a  diversion  path  parameter. 

FALSIFICATION  OF  RECORDS 

A  diversion  path  parameter  for  referencing  deliberate  recording  of 
differences  between  information  or  data  elements  and  current  reality 
as  a  part  of  the  concealment  plan  of  the  diverter. 
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GENERALIZED  DIVERSION  PATH 

A  description,  in  terms  of  diversion  path  parameters,  of  a  potential 
means  for  illicitly  removing  and  concealing  the  removal  of  SNM. 

INSIDER 

A  diversion  path  parameter  value  of  the  parameter  for  type  of 
individual,  indicating  an  employee  who  is  authorized  access  to  both 
the  plant-site  and  to  the  SNM. 

INTERNAL  CONTROL 

The  plan  of  organization  and  all  of  the  coordinate  methods  and 
measures  adopted  within  a  business  to  safeguard  its  assets,  check  the 
accuracy  and  reliability  of  its  accounting  data,  promote  operational 
efficiency,  and  encourage  adherence  to  prescribed  managerial 
policies  [3] . . 

MASS  SENSITIVITY 

An  attribute  of  diversion  indication  for  denoting  that  in  the  event  of 
a  diversion  of  a  threshold  mass  of  X  grams,  there  is  at  least  a  p% 
probability  that  a  signal  in  the  information,  i.e.,  an  abnormal 
situation,  will  result  which  will  serve  to  initiate  additional 
investigation.     Also,  a  boundary  condition  for  specifying  the  quantity 
of  the  threhold  mass. 

MATERIAL  ATTRACTIVENESS 

A  diversion  path  parameter  for  expressing  the  concept  that  when 
several  material  types  or  descriptions  are  subject  to  illicit 
removal  from  an  area,  some  may  be  more  desirable  to  a  diverter  than 
others  because  of  the  ready  or  easy  adaptation  to  intended  end-use. 

MATERIAL  DESCRIPTION 

The  physical  form  (solid,  liquid  or  gas)  and  chemical  form 
(composition,  pur ity}  concentration,  etc.)  of  the  SNM  as  distinquished 
from  material  type. 

MATERIAL  TYPE 

The  nuclear  properties  of  the  SNM  (depleted-U,  enriched-U,  Pu-240 
content,  etc.). 

NUMBER  OF  INDIVIDUALS 

A  diversion  path  parameter  for  indicating  the  number  of  persons 
participating  in  the  diversion.     Two  or  more  persons  acting  in 
concert  are  considered  to  be  in  collusion  and  using  the  same 
diversion  path.     When  acting  independently,  even  if  removing  SNM 
from  the  same  area,  they  are  considered  to  be  using  different 
diversion  paths. 

OUTSIDE  EMPLOYEE 

A  diversion  path  parameter  value  of  the  parameter  for  type  of 
individual,  indicating  an  employee  who  is  authorized  access  to  the 
plant-site  but  not  to  the  SNM. 
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OUTSIDE  VISITOR 

A  diversion  path  parameter  value  of  the  parameter  for  type  of 
individual,  indicating  a  non-employee  who  is  authorized  access, 
under  escort,  to  both  the  plant-site  and  to  the  SNM. 

PATH  COMPLEXITY 

The  collective  consideration,  for  a  generalized  diversion  path, 
of  all  diversion  path  parameters  except  material  attractiveness 
which  serves  to  express  the  interrelationship  of  these  parameters, 


RECYCLE 


SNM  suitable  for  use  in  another  unit  process  without  undergoing 
prior  chemical  processing. 


RELATIVE  PATH  WEIGHT 

The  numerical  value  derived  as  the  product  of  relative  weight  factors 
(one  for  each  diversion  path  parameter  to  reflect  both  material 
attractiveness  and  path  complexity)  as  a  means  of  expressing  relative 
order  or  rank  of  generalized  diversion  paths. 

RELATIVE  WEIGHT  FACTOR 

The  relative  numerical  value  assigned  to  a  particular  diversion  path 
parameter  value. 

REMOVAL  MODE 

A  diversion  path  parameter  for  indicating  one  of  three  removal 
mechanisms  available  to  a  diverter,  namely:   (!)  removal  of  SNM 
without  replacement  of  any  kind  (simple  theft) ;  (2)  removal  of  SNM 
accompanied  by  substitution  of  inert  material;  and  (3)  removal  of  SNM 
accompanied  by  substitution  of  SNM  having  different  isotopic 
composition. 


SCRAP 


SNM  which  must  be  sent  to  chemical  recovery  before  further  use  is 
possible. 


SENSITIVITY 

See  MASS  SENSITIVITY,  TIME  SENSITIVITY  and  SPACE  SENSITIVITY. 

SPACE  SENSITIVITY 

An  attribute  of  diversion  indication  for  denoting  that  in  the 
event  of  diversion,  there  is  at  least  a  p%  probability  that  there 
will  be  a  signal  in  the  information  (i.e.,  an  abnormal  situation) 
pinpointing  the  area  wherein  removal  occurred  and  highlighting  the 
personnel  having  access  to  the  SNM.     Also  a  boundary  condition  for 
specifying  the  area  and  personnel  included  in  the  analysis. 

TIME  SENSITIVITY 

An  attribute  of  diversion  indication  for  denoting  that  in  the  event 
of  diversion,  there  is  at  least  a  p%  probability  that  there  will  be 
a  signal  in  the  information  (i.e.,  an  abnormal  situation)  observed 
within  d  days.     Also  a  boundary  condition  for  specifying  the  time 
interval  within  which  observation  should  occur. 
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TYPE  OF  INDIVIDUAL 

A  diversion  path  parameter  for  expressing  one  of  four  levels  of 
access  authorization  possessed  by  a  diverter,  namely:   (1)  insider; 
(2)  outside  employee;   (3)  outside  visitor;  or  (4)  unauthorized  person. 

UNAUTHORIZED  PERSON 

A  diversion  path  parameter  value  of  the  parameter  for  type  of 
individual  indicating  a  non-employee  who  is  not  authorized  access 
to  either  the  plant-site  or  to  the  SNM. 

UNIT  PROCESS 

The  subdivision  (for  purposes  of  analysis)  of  the  overall  process 
stream  of  a  plant  into  many  smaller  operations  (the  unit  processes) , 
each  of  which  is  characterized  by  a  "branch  point"  in  the  process 
stream,  where  material  changes  its  physical  or  chemical  form  or 
composition,  or  where  by-product,  such  as  recycle  or  scrap,  is 
generated. 
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